Oct 1, 2017

Lock Down your ColdFusion Connector

On my production servers I like to lock down all the Tomcat Connectors to only use a local address.

Each ColdFusion server has a file located in <servername>\runtime\conf\server.xml

In that file you will find Connector definitions,  for AJP or HTTP.  The AJP connectors are for your web server to communicate to ColdFusion.  The HTTP version are for in internal web server, typically used as a means to access the ColdFusion Administrator.

According to Tomcat documentation if you do not specify an address for the Connector, Tomcat will bind to all available IP addresses.

So if your web server is local there is no need to bind to anything other then localhost or 127.0.0.1.

The default Connector looks like the following:

 <Connector  port="8016" protocol="AJP/1.3" redirectPort="8449" tomcatAuthentication="false" maxThreads="500" connectionTimeout="60000"/>

I like to add address="127.0.0.1" so the end result looks like this:

 <Connector  address="127.0.0.1" port="8016" protocol="AJP/1.3" redirectPort="8449" tomcatAuthentication="false" maxThreads="500" connectionTimeout="60000"/>

This locks the port 8016 to only 127.0.0.1.

I would recommend this for all the Connector tags in the server.xml.

If you are using a remote web server, you can still use this feature to only bind to the actual IP the web server will be talking too.

Your ports will most likely be different and your maxthreads may be different.





4 comments:

  1. Replies
    1. Big data is a term that describes the large volume of data – both structured and unstructured – that inundates a business on a day-to-day basis. big data projects for students But it’s not the amount of data that’s important.Project Center in Chennai

      Spring Framework has already made serious inroads as an integrated technology stack for building user-facing applications. Corporate TRaining Spring Framework the authors explore the idea of using Java in Big Data platforms.

      Spring Training in Chennai

      The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

      Delete